EUVD-2026-17500
GHSA-mfj6-6p54-m98c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionGitHub Advisory
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.68 and 9.7.0-alpha.12, the GraphQL query complexity validator can be exploited to cause a denial-of-service by sending a crafted query with binary fan-out fragment spreads. A single unauthenticated request can block the Node.js event loop for seconds, denying service to all concurrent users. This only affects deployments that have enabled the requestComplexity.graphQLDepth or requestComplexity.graphQLFields configuration options. This issue has been patched in versions 8.6.68 and 9.7.0-alpha.12.
AnalysisAI
GraphQL query complexity validator in Parse Server allows remote denial-of-service via crafted queries with binary fan-out fragment spreads, blocking the Node.js event loop for seconds with a single unauthenticated request. Parse Server versions prior to 8.6.68 and 9.7.0-alpha.12 are affected when requestComplexity.graphQLDepth or requestComplexity.graphQLFields options are enabled. EPSS data not provided; no public exploit identified at time of analysis. CVSS 8.2 (High) reflects network-accessible attack with low complexity requiring no privileges, causing high availability impact.
Technical ContextAI
Parse Server is an open-source Backend-as-a-Service platform deployable on Node.js infrastructure, providing GraphQL API endpoints. The vulnerability (CWE-407: Inefficient Algorithmic Complexity) resides in the GraphQL query complexity validation logic. When deployments enable requestComplexity.graphQLDepth or requestComplexity.graphQLFields configuration options to limit expensive queries, the validator can be exploited using specially crafted queries containing binary fan-out fragment spreads. These malformed fragments trigger exponential or polynomial-time validation algorithms that exhaust CPU resources on the main Node.js event loop. Since Node.js is single-threaded for JavaScript execution, blocking the event loop prevents processing of all concurrent requests, creating a resource exhaustion denial-of-service condition. The affected product CPE cpe:2.3:a:parse-community:parse-server identifies the parse-community Parse Server package as the vulnerable component.
RemediationAI
Upgrade Parse Server to version 8.6.68 or later for production 8.x deployments, or version 9.7.0-alpha.12 or later for development 9.x branches. Vendor-released patches are available through the standard npm package distribution channel. The fix is implemented in upstream commits ea15412795f34594cc8a674fe858d445675e0295 (8.x branch) and f759bda075298ec44e2b4fb57659a0c56620483b (9.x branch) as documented in pull requests https://github.com/parse-community/parse-server/pull/10344 and https://github.com/parse-community/parse-server/pull/10345. Organizations unable to immediately upgrade should consider temporarily disabling requestComplexity.graphQLDepth and requestComplexity.graphQLFields configuration options to eliminate the attack surface, though this removes query complexity protection. Implement network-layer rate limiting and request timeout controls as additional defense-in-depth measures for GraphQL endpoints. Review the vendor security advisory at https://github.com/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98c for detailed remediation guidance and configuration recommendations.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today